The Standard

The Standard
DeFiHardhat
20,000 USDC
View results
Submission Details
Severity: low
Invalid

Stakes are not consolidated at deadline.

Vulnerability details

function consolidatePendingStakes() private {
uint256 deadline = block.timestamp - 1 days;
for (int256 i = 0; uint256(i) < pendingStakes.length; i++) {
PendingStake memory _stake = pendingStakes[uint256(i)];
if (_stake.createdAt < deadline) {
positions[_stake.holder].holder = _stake.holder;
positions[_stake.holder].TST += _stake.TST;
positions[_stake.holder].EUROs += _stake.EUROs;
deletePendingStake(uint256(i));
// pause iterating on loop because there has been a deletion. "next" item has same index
i--;
}
}
}

if (_stake.createdAt < deadline)

Stakes will not be consolidated at deadline even though they have been locked for 24 hours. In some scenarios, like when the stakes are consolidated before distributing assets (distributeAssets), user will not be eligible to the rewards even though they should already be.

Impact

User stake will not be consolidated at deadline. In some scenarios user will not receive funds that he is eligible to.

Recommendations

Change if (_stake.createdAt < deadline) to if (_stake.createdAt =< deadline).

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.